                      {:status 302
                       :headers {"Location"
                                 (format
-                                 "http://localhost:8010/oauth/grant?code=%s&state=%s"
-                                 code state
+                                 ;; TODO: Replace this with the callback uri
+                                 "%s?code=%s&state=%s"
+                                 callback-uri code state
                                  )}
                       :cookies {"session-id" (->cookie session)}})))
                ;; Fail
                {:status 302
-                :headers {"Location" (str "/login/oauth/authorize?client_id=" client-id)}
-                :body "Try again"}
-               )
-
-             )
-           )
-         wrap-params wrap-cookies)
+                :headers {"Location" (format "%s?client_id=%s" (path-for (:modular.bidi/routes req) ::get-authenticate-form) client-id)}
+                :body "Try again"})))
+
+         wrap-params wrap-cookies s/with-fn-validation)
 
      ::get-totp-code
      (fn [req]

      (let [access-token (second (re-matches #"\Qtoken\E\s+(.*)" (get (:headers request) "authorization")))
            session (get-session (:access-token-store this) access-token)
            scopes (:scopes session)]

        (infof "session is %s, scopes is %s" session scopes)

        (when scopes
          (scopes scope)))

      ;; Not a valid scope

      (throw (ex-info "Not a valid scope!" {:scope scope}))

      )))

(defn new-oauth2-access-token-authorizer [& {:as opts}]
  (component/using (->OAuth2AccessTokenAuthorizer) [:access-token-store :auth-server])
)

     ::post-totp-code
     (-> (fn [req]
           (let [code (-> req :form-params (get "code"))
                 secret (get-session-value req "session-id" (:session-store this) :totp-secret)
                 ]
             (if (= code (totp-token secret))
               ;; Success, set up the exchange
               (let [session (get-session (:session-store this) (get-cookie-value req "session-id"))
                     client-id (get session :client-id)
                     _ (infof "Looking up app with client-id %s yields %s" client-id (lookup-application+ (:application-registry this) client-id))
                     {:keys [callback-uri] :as application}
                     (lookup-application+ (:application-registry this) client-id)
                     state (get session :state)
                     identity (get session :cylon/identity)
                     code (str (java.util.UUID/randomUUID))]

                 ;; Remember the code for the possible exchange - TODO expire these
